Chapter 25 — Laboratory I

Chapter 25 — Laboratory I

Lesson map

Lesson 25 published. Map, example, EX073.

flowchart TD
  N0["Learning outcomes"]
  N1["25.1 Planning the test"]
  N2["25.2 Running and recording"]
  N3["25.3 Comparing with expectations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX073"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["25.1 Planning the test"]
  N2["25.2 Running and recording"]
  N3["25.3 Comparing with expectations"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX073"]

[Learning outcomes]
    |
    v
[25.1 Planning the test]
    |
    v
[25.2 Running and recording]
    |
    v
[25.3 Comparing with expectations]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX073]

Learning outcomes

You will (1) test a control in a safe environment; (2) record evidence properly; (3) compare results with expectations.

25.1 Planning the test

In the first laboratory, Sofia tests Elmfield's backup control using a test copy of the file share provided by the IT lead. The test checks that a backup exists for each day of the last week, that it is stored offline and that a sample of files can be restored. She writes the steps, expected results and evidence to collect before starting. Testing in a copy ensures that nothing in live use is disturbed. Writing the expected results before starting means the test cannot quietly be redefined if something fails.

25.2 Running and recording

Sofia restores twenty files chosen at random from different folders and dates. Nineteen restore correctly. One, a large spreadsheet, fails because the backup excluded files above a size limit. She records the date, steps, results, screenshots and file list. She stores the evidence in a folder that only she and the IT lead can change. She learns that evidence must allow someone else to understand what was tested and see the result for themselves. Choosing files from different folders and dates made it more likely that a hidden exclusion such as the size limit would show.

25.3 Comparing with expectations

The control description said all files are backed up nightly; the test shows large files are excluded. Sofia reports the gap with its likely impact: large spreadsheets include rent arrears records. The IT lead changes the setting and asks her to retest, which passes. She learns that testing reveals the difference between what a control is believed to do and what it does, and that this difference is often caused by a forgotten configuration choice. Dr. Haddad asks why nobody noticed earlier, and Sofia points out that the nightly backup report showed success because excluded files were never counted as failures.

Worked example

Sofia tests backups in a copy, restores nineteen of twenty files, finds a size exclusion and confirms the fix with a retest.

Synthetic case. The test is synthetic.

Errors and limits

Small samples miss rare failures. Test copies may differ from live systems.

Exercises

• EX073 — Restore result. How many sampled files restored correctly? Rubric: 3 = nineteen of twenty;; 2 = 19;; 1 = 20;; 0 = none.
• EX074 — Failure cause. Why did one file fail to restore? Rubric: 3 = backup excluded files above a size limit;; 2 = size limit;; 1 = vague;; 0 = none.
• EX075 — Belief versus reality. What did the test reveal about the control? Rubric: 3 = it did less than believed because of a forgotten setting;; 2 = gap;; 1 = vague;; 0 = none.

Synthesis

Laboratory testing shows what controls really do and produces evidence for fixes.

Continue studying — chapter 25 of 40

← Chapter 24 (draft) · Course chapter index · Chapter 26 (draft) →